opencode-swarm 7.148.4 → 7.148.5

package/dist/cli/{index-hj1xd3pg.js → index-3aev3a0c.js}

@@ -10,13 +10,13 @@ import {
 import {
   normalizeToolNameLowerCase,
   stableCanonicalStringify
-} from "./index-b94487xm.js";
+} from "./index-arjq717j.js";
 import {
   detectStraySwarmDirs,
   readDoctorArtifact,
   removeStraySwarmDir,
   runConfigDoctor
-} from "./index-1vbmra32.js";
+} from "./index-5r2mcgpa.js";
 import {
   MAX_TRANSIENT_RETRIES,
   archiveEvidence,
@@ -62,7 +62,7 @@ import {
   updateTaskStatus,
   validateProjectRoot,
   validateSymlinkBoundary
-} from "./index-b1c83zf9.js";
+} from "./index-zhn0q7nf.js";
 import {
   EvaluationTaskV1Schema,
   GateAuditManifestV1Schema,
@@ -105,12 +105,12 @@ import {
 } from "./index-y8552snf.js";
 import {
   readRecentEscalations
-} from "./index-ye7kpzrk.js";
+} from "./index-vyg5b8ee.js";
 import {
   alreadyCuratedThisGeneration,
   claimNextScanBatch,
   resolveCohortId
-} from "./index-w00hn0dd.js";
+} from "./index-zf2vwa7y.js";
 import {
   CURATOR_INIT_PROMPT,
   CURATOR_PHASE_PROMPT,
@@ -180,7 +180,7 @@ import {
   retireSkill,
   selectCandidateEntries,
   syncBundledProjectSkillsIfMissingAsync
-} from "./index-bccfz7br.js";
+} from "./index-jzz52as5.js";
 import {
   appendUnactionable,
   quarantineEntry,
@@ -191,7 +191,7 @@ import {
   validateActionableFields,
   validateLesson,
   validateSkillPath
-} from "./index-gswx08pr.js";
+} from "./index-kj6m9ry3.js";
 import {
   authorizeCuration,
   buildConfigFingerprintInput
@@ -252,18 +252,18 @@ import {
   transitionTaskWorkflowEvidence,
   withTaskEvidenceTransaction,
   writeWorkflowWalFile
-} from "./index-622phhp5.js";
+} from "./index-haf092ak.js";
 import {
   provisionWorktree,
   removeWorktree
-} from "./index-8kzrgjt6.js";
+} from "./index-5zq3892p.js";
 import {
   MAX_PENDING_SCOPE_BINDINGS,
   canonicalWorkspaceIdentity,
   clearAllScopes,
   clearScopeBindingFromDisk,
   clearScopeBindings
-} from "./index-6kw1a3bk.js";
+} from "./index-q7ke7kwd.js";
 import {
   appendLedgerEvent,
   computePlanHash,
@@ -278,7 +278,7 @@ import {
   readPlanEpochIdentity,
   replayFromLedgerWithStatus,
   takeSnapshotEvent
-} from "./index-9m8jy3av.js";
+} from "./index-x3d9asnz.js";
 import {
   isPathWithinDeclaredScope,
   sanitizeDiagnosticText
@@ -330,7 +330,7 @@ import {
   transactFile,
   transactKnowledge,
   wordBigrams
-} from "./index-sxtz2d26.js";
+} from "./index-1w5nnyew.js";
 import {
   MAX_EVENT_LOG_ENTRIES,
   _internals as _internals2,
@@ -344,10 +344,10 @@ import {
   recordKnowledgeEvent,
   recordPhaseCloseIntent,
   resolveKnowledgeEventsPath
-} from "./index-skgeytf6.js";
+} from "./index-ne45ew6z.js";
 import {
   resolveWorktreeIsolationConfig
-} from "./index-0045n7qe.js";
+} from "./index-c6jqkx9d.js";
 import {
   RetrospectiveEvidenceSchema
 } from "./index-gprxjmm7.js";
@@ -357,7 +357,7 @@ import {
   init_loader,
   loadPluginConfig,
   loadPluginConfigWithMeta
-} from "./index-7rerkeg8.js";
+} from "./index-59wqcatm.js";
 import {
   DEFAULT_SKILL_OPT_CONFIG,
   FALLBACK_MODELS_MAX,
@@ -371,7 +371,7 @@ import {
   package_default,
   resolveAutoReviewConfig,
   stripKnownSwarmPrefix
-} from "./index-yq89bgnz.js";
+} from "./index-yezd5ks6.js";
 import {
   AGENT_TOOL_MAP,
   ALL_AGENT_NAMES,
@@ -5608,7 +5608,7 @@ async function cleanupRecoveredWorktree(directory, descriptor) {
     awaitingMergeByCallID,
     cleanupStandardWorktreeForCallId,
     standardWorktreeByCallID
-  } = await import("./worktree-isolation-sbsdx1yj.js");
+  } = await import("./worktree-isolation-ay9d58w4.js");
   standardWorktreeByCallID.delete(descriptor.callID);
   if (hasResidue)
     awaitingMergeByCallID.set(descriptor.callID, {
@@ -5710,7 +5710,7 @@ async function recoverCoderSettlement(directory, taskId) {
           awaitingMergeByCallID,
           finishStandardWorktreeDispatch,
           standardWorktreeByCallID
-        } = await import("./worktree-isolation-sbsdx1yj.js");
+        } = await import("./worktree-isolation-ay9d58w4.js");
         const descriptor = wal.worktree;
         const reconstructedDispatch = {
           callID: descriptor.callID,
@@ -18386,7 +18386,7 @@ function planMerges(active, threshold, maxComparisons, maxMerges) {
   };
 }
 async function sweepActiveNearDuplicates(directory, options = {}) {
-  const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-9qzkcmry.js");
+  const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-qbsc2btq.js");
   const { config } = loadPluginConfigWithMeta2(directory);
   const sweepConfig = config.learning?.dedup_sweep;
   if (sweepConfig?.enabled === false)
@@ -19504,7 +19504,7 @@ async function runCuratorPhase(directory, phase, agentsDispatched, config, knowl
     }
     if (config.skill_generation_enabled === true && skillCandidates.length > 0) {
       try {
-        const skillModule = await import("./skill-generator-fh8emssb.js");
+        const skillModule = await import("./skill-generator-c65y1h6a.js");
         for (const cand of skillCandidates) {
           if (cand.confidence < (config.min_skill_confidence ?? DEFAULT_SKILL_MIN_CONFIDENCE)) {
             continue;
@@ -19976,7 +19976,7 @@ async function applyCuratorKnowledgeUpdates(directory, recommendations, knowledg
     } catch {}
   }
   if (contradictedEntries.length > 0 && knowledgeConfig.contradiction_threshold_action === "quarantine") {
-    const { maybeQuarantineOnContradiction } = await import("./knowledge-escalator-9w53tx55.js");
+    const { maybeQuarantineOnContradiction } = await import("./knowledge-escalator-bvrtfdyb.js");
     for (const { id } of contradictedEntries) {
       try {
         await maybeQuarantineOnContradiction(directory, id, knowledgeConfig.contradiction_quarantine_threshold, knowledgeConfig.contradiction_quarantine_window_days);
@@ -20795,7 +20795,7 @@ async function runCuratorPostMortem(directory, options = {}) {
       warnings.push("Failed to collect knowledge summary.");
     }
     try {
-      const { getScanStatus } = await import("./scan-cursor-www6dbn8.js");
+      const { getScanStatus } = await import("./scan-cursor-7n0zs72g.js");
       const scanStatus = await getScanStatus(directory);
       if (scanStatus.remaining_estimate > 0) {
         warnings.push(`Fair scan: reviewed ${knowledgeSummary.length} entries this sweep (generation ${scanStatus.generation}); ${scanStatus.remaining_estimate} more eligible entries will be visited in future curation sweeps.`);
@@ -20967,9 +20967,9 @@ var _internals26 = {
   verifyPostMortemKnowledgeActions,
   repairPostMortemActions,
   loadDefaultKnowledgeConfig: async (directory) => {
-    const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-vyg0k7rh.js");
+    const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-e59spg93.js");
     try {
-      const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-9qzkcmry.js");
+      const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-qbsc2btq.js");
       const loaded = loadPluginConfigWithMeta2(directory);
       return KnowledgeConfigSchema2.parse(loaded.config.knowledge ?? {});
     } catch {
@@ -20977,11 +20977,11 @@ var _internals26 = {
     }
   },
   applyCuratorKnowledgeUpdates: async (directory, recommendations, knowledgeConfig, generation) => {
-    const { applyCuratorKnowledgeUpdates: applyCuratorKnowledgeUpdates2 } = await import("./curator-8y57gq1g.js");
+    const { applyCuratorKnowledgeUpdates: applyCuratorKnowledgeUpdates2 } = await import("./curator-pffqw3br.js");
     return applyCuratorKnowledgeUpdates2(directory, recommendations, knowledgeConfig, generation);
   },
   checkHivePromotions: async (entries, knowledgeConfig, directory) => {
-    const { checkHivePromotions } = await import("./hive-promoter-te5d78yt.js");
+    const { checkHivePromotions } = await import("./hive-promoter-jvyzykgx.js");
     return checkHivePromotions(entries, knowledgeConfig, directory);
   },
   applyProposalTriage: async (directory, triage) => {
@@ -20990,7 +20990,7 @@ var _internals26 = {
       activateProposal,
       listSkills: listSkills2,
       sanitizeSlug
-    } = await import("./skill-generator-fh8emssb.js");
+    } = await import("./skill-generator-c65y1h6a.js");
     const result = {
       approved: [],
       rejected: [],
@@ -22326,9 +22326,9 @@ function hashContent(content) {
   return createHash10("sha1").update(content).digest("hex");
 }
 async function loadConfigForPolicyCurator(directory) {
-  const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-vyg0k7rh.js");
+  const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-e59spg93.js");
   try {
-    const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-9qzkcmry.js");
+    const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-qbsc2btq.js");
     const { config: loadedConfig } = loadPluginConfigWithMeta2(directory);
     return KnowledgeConfigSchema2.parse(loadedConfig.knowledge ?? {});
   } catch {
@@ -33524,7 +33524,7 @@ async function runFinalizeStage(ctx) {
     }
   }
   try {
-    const { CuratorConfigSchema: CCS } = await import("./schema-vyg0k7rh.js");
+    const { CuratorConfigSchema: CCS } = await import("./schema-e59spg93.js");
     const { config: pmLoadedConfig } = _internals41.loadPluginConfigWithMeta(ctx.directory);
     const curatorCfg = CCS.parse(pmLoadedConfig.curator ?? {});
     if (curatorCfg.enabled && curatorCfg.postmortem_enabled) {
@@ -35717,9 +35717,9 @@ var _internals45 = {
   loadPluginConfigWithMeta,
   loadCuratorDeps: async () => {
     const [{ CuratorConfigSchema }, curator, { createCuratorLLMDelegate: createCuratorLLMDelegate2 }] = await Promise.all([
-      import("./schema-vyg0k7rh.js"),
-      import("./curator-8y57gq1g.js"),
-      import("./curator-llm-factory-rj4vw5fd.js")
+      import("./schema-e59spg93.js"),
+      import("./curator-pffqw3br.js"),
+      import("./curator-llm-factory-mbsn281q.js")
     ]);
     return { CuratorConfigSchema, curator, createCuratorLLMDelegate: createCuratorLLMDelegate2 };
   }
@@ -36709,7 +36709,7 @@ async function computeCurationDiagnostics(directory, entries) {
   let scanCompleted = false;
   let scanRemaining = 0;
   try {
-    const { getScanStatus } = await import("./scan-cursor-www6dbn8.js");
+    const { getScanStatus } = await import("./scan-cursor-7n0zs72g.js");
     const status = await getScanStatus(directory);
     scanGeneration = status.generation;
     scanCompleted = status.completed;
@@ -36719,10 +36719,10 @@ async function computeCurationDiagnostics(directory, entries) {
   try {
     const { isLinked: isLinked2 } = await import("./knowledge-link-spw879rs.js");
     if (isLinked2(directory)) {
-      const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-vyg0k7rh.js");
+      const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-e59spg93.js");
       let config;
       try {
-        const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-9qzkcmry.js");
+        const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-qbsc2btq.js");
         const loaded = loadPluginConfigWithMeta2(directory);
         config = KnowledgeConfigSchema2.parse(loaded.config.knowledge ?? {});
       } catch {
@@ -38033,7 +38033,7 @@ async function handleDoctorCommand(directory, args) {
   const result = runConfigDoctor(config, directory);
   let output;
   if (enableAutoFix && result.hasAutoFixableIssues) {
-    const { runConfigDoctorWithFixes } = await import("./config-doctor-ycf9ws4p.js");
+    const { runConfigDoctorWithFixes } = await import("./config-doctor-6z7x0jnz.js");
     const fixResult = await runConfigDoctorWithFixes(directory, config, true, {
       applyLossy: true
     });
@@ -38973,7 +38973,7 @@ async function handleEvidenceCommand(directory, args) {
   return formatTaskEvidenceMarkdown(evidenceData);
 }
 async function handleEvidenceSummaryCommand(directory) {
-  const { buildEvidenceSummary } = await import("./evidence-summary-service-wkp0gfpd.js");
+  const { buildEvidenceSummary } = await import("./evidence-summary-service-9ajw5tpc.js");
   const artifact = await buildEvidenceSummary(directory);
   if (!artifact) {
     return "No plan found. Run `/swarm plan` to check plan status.";
@@ -41962,7 +41962,974 @@ var javaRules = [
   }
 ];
 
+// src/sast/rules/javascript-call-classifier.ts
+var MAX_ANALYSIS_BYTES = 512 * 1024;
+var CHILD_PROCESS_MODULES = new Set(["child_process", "node:child_process"]);
+var analysisByContext = new WeakMap;
+var dispositionByContext = new WeakMap;
+var tokenPairsByList = new WeakMap;
+var ASSIGNMENTS = new Set([
+  "=",
+  "+=",
+  "-=",
+  "*=",
+  "/=",
+  "%=",
+  "&&=",
+  "||=",
+  "??="
+]);
+var DECLARATION_KEYWORDS = new Set(["const", "let", "var"]);
+function isIdentifierStart(char) {
+  return /[A-Za-z_$]/.test(char);
+}
+function isIdentifierPart(char) {
+  return /[A-Za-z0-9_$]/.test(char);
+}
+function canStartRegex(previous) {
+  if (!previous)
+    return true;
+  if (previous.kind === "identifier") {
+    return [
+      "return",
+      "throw",
+      "case",
+      "delete",
+      "typeof",
+      "void",
+      "yield",
+      "await"
+    ].includes(previous.value);
+  }
+  return previous.kind === "punctuator" && [
+    "(",
+    "[",
+    "{",
+    "=",
+    ":",
+    ",",
+    ";",
+    "!",
+    "?",
+    "=>",
+    "&&",
+    "||",
+    "??"
+  ].includes(previous.value);
+}
+function tokenize2(content) {
+  const tokens = [];
+  let malformed = false;
+  let index = 0;
+  while (index < content.length) {
+    const char = content[index];
+    const next = content[index + 1];
+    if (/\s/.test(char)) {
+      index++;
+      continue;
+    }
+    if (char === "/" && next === "/") {
+      index += 2;
+      while (index < content.length && content[index] !== `
+`)
+        index++;
+      continue;
+    }
+    if (char === "/" && next === "*") {
+      const start = index;
+      index += 2;
+      while (index < content.length && !(content[index] === "*" && content[index + 1] === "/")) {
+        index++;
+      }
+      if (index >= content.length) {
+        malformed = true;
+        break;
+      }
+      index += 2;
+      if (index <= start)
+        malformed = true;
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      const quote = char;
+      const start = index++;
+      let value2 = "";
+      let closed = false;
+      while (index < content.length) {
+        const current = content[index];
+        if (current === "\\") {
+          value2 += current;
+          if (index + 1 < content.length)
+            value2 += content[index + 1];
+          index += 2;
+          continue;
+        }
+        if (current === quote) {
+          index++;
+          closed = true;
+          break;
+        }
+        value2 += current;
+        index++;
+      }
+      if (!closed)
+        malformed = true;
+      tokens.push({ kind: "string", value: value2, start, end: index });
+      continue;
+    }
+    if (char === "`") {
+      const start = index++;
+      tokens.push({ kind: "template", value: "", start, end: start + 1 });
+      let closed = false;
+      while (index < content.length) {
+        if (content[index] === "\\") {
+          index += 2;
+          continue;
+        }
+        if (content[index] === "$" && content[index + 1] === "{") {
+          const expressionStart = index + 2;
+          let cursor = expressionStart;
+          let depth = 1;
+          let quote = null;
+          while (cursor < content.length && depth > 0) {
+            const current = content[cursor];
+            if (quote) {
+              if (current === "\\")
+                cursor++;
+              else if (current === quote)
+                quote = null;
+            } else if (current === '"' || current === "'")
+              quote = current;
+            else if (current === "{")
+              depth++;
+            else if (current === "}")
+              depth--;
+            cursor++;
+          }
+          if (depth !== 0) {
+            malformed = true;
+            index = cursor;
+            break;
+          }
+          const nested = tokenize2(content.slice(expressionStart, cursor - 1));
+          for (const token of nested.tokens) {
+            tokens.push({
+              ...token,
+              start: token.start + expressionStart,
+              end: token.end + expressionStart
+            });
+          }
+          malformed ||= nested.malformed;
+          index = cursor;
+          continue;
+        }
+        if (content[index] === "`") {
+          index++;
+          closed = true;
+          break;
+        }
+        index++;
+      }
+      if (!closed)
+        malformed = true;
+      continue;
+    }
+    if (char === "/" && canStartRegex(tokens.at(-1))) {
+      const start = index++;
+      let inClass = false;
+      let closed = false;
+      while (index < content.length) {
+        const current = content[index];
+        if (current === "\\") {
+          index += 2;
+          continue;
+        }
+        if (current === "[")
+          inClass = true;
+        if (current === "]")
+          inClass = false;
+        if (current === "/" && !inClass) {
+          index++;
+          while (index < content.length && /[A-Za-z]/.test(content[index]))
+            index++;
+          closed = true;
+          break;
+        }
+        if (current === `
+`)
+          break;
+        index++;
+      }
+      if (!closed)
+        malformed = true;
+      tokens.push({
+        kind: "regex",
+        value: content.slice(start, index),
+        start,
+        end: index
+      });
+      continue;
+    }
+    if (isIdentifierStart(char)) {
+      const start = index++;
+      while (index < content.length && isIdentifierPart(content[index]))
+        index++;
+      tokens.push({
+        kind: "identifier",
+        value: content.slice(start, index),
+        start,
+        end: index
+      });
+      continue;
+    }
+    if (/\d/.test(char)) {
+      const start = index++;
+      while (index < content.length && /[\w.]/.test(content[index]))
+        index++;
+      tokens.push({
+        kind: "number",
+        value: content.slice(start, index),
+        start,
+        end: index
+      });
+      continue;
+    }
+    const punctuator = [
+      "?.",
+      "=>",
+      "===",
+      "!==",
+      "==",
+      "!=",
+      "++",
+      "--",
+      "+=",
+      "-=",
+      "*=",
+      "/=",
+      "%=",
+      "&&=",
+      "||=",
+      "??=",
+      "&&",
+      "||",
+      "??",
+      "..."
+    ].find((candidate) => content.startsWith(candidate, index));
+    const value = punctuator ?? char;
+    tokens.push({
+      kind: "punctuator",
+      value,
+      start: index,
+      end: index + value.length
+    });
+    index += value.length;
+  }
+  return { tokens, malformed };
+}
+function addDeclaration(analysis, name) {
+  analysis.declarations.set(name, (analysis.declarations.get(name) ?? 0) + 1);
+}
+function addFact(analysis, name, fact, tokenIndex) {
+  const facts = analysis.facts.get(name) ?? new Set;
+  facts.add(fact);
+  analysis.facts.set(name, facts);
+  const scope = declarationScope(analysis, tokenIndex);
+  const scopedFacts = analysis.factScopes.get(name) ?? new Map;
+  const factsAtScope = scopedFacts.get(scope) ?? new Set;
+  factsAtScope.add(fact);
+  scopedFacts.set(scope, factsAtScope);
+  analysis.factScopes.set(name, scopedFacts);
+}
+function addScopedMarker(store, name, scope) {
+  const scopes = store.get(name) ?? new Set;
+  scopes.add(scope);
+  store.set(name, scopes);
+}
+function hasScopedMarker(store, name, scope) {
+  return scope !== null && (store.get(name)?.has(scope) ?? false);
+}
+function visibleScopeAt(analysis, name, callIndex) {
+  return visibleDeclarationScope(analysis, name, callIndex) ?? analysis.scopeAtToken[callIndex] ?? 0;
+}
+function hasVisibleMarker(analysis, store, name, callIndex) {
+  let scope = visibleScopeAt(analysis, name, callIndex);
+  while (scope >= 0) {
+    if (store.get(name)?.has(scope))
+      return true;
+    scope = analysis.scopeParents[scope] ?? -1;
+  }
+  return false;
+}
+function factsAtVisibleScope(analysis, name, callIndex) {
+  const scope = visibleDeclarationScope(analysis, name, callIndex);
+  return scope === null ? undefined : analysis.factScopes.get(name)?.get(scope);
+}
+function tokenPairs(tokens) {
+  const cached = tokenPairsByList.get(tokens);
+  if (cached)
+    return cached;
+  const pairs = new Map;
+  const stack = [];
+  const matching = { ")": "(", "]": "[", "}": "{" };
+  for (let index = 0;index < tokens.length; index++) {
+    const value = tokens[index]?.value;
+    if (value === "(" || value === "[" || value === "{") {
+      stack.push({ value, index });
+      continue;
+    }
+    const open2 = matching[value ?? ""];
+    if (!open2)
+      continue;
+    const top = stack.at(-1);
+    if (!top || top.value !== open2)
+      continue;
+    stack.pop();
+    pairs.set(top.index, index);
+    pairs.set(index, top.index);
+  }
+  tokenPairsByList.set(tokens, pairs);
+  return pairs;
+}
+function pairedToken(tokens, index) {
+  return tokenPairs(tokens).get(index) ?? -1;
+}
+function buildScopes(tokens) {
+  const scopeAtToken = [];
+  const scopeParents = [-1];
+  const scopeIsFunction = [true];
+  const stack = [0];
+  const braceCreatesScope = [];
+  for (let index = 0;index < tokens.length; index++) {
+    scopeAtToken[index] = stack.at(-1);
+    if (tokens[index]?.value === "{") {
+      const previous = tokens[index - 1];
+      let cursor = index - 1;
+      let importClause = false;
+      while (cursor >= 0 && ![";", "{", "}"].includes(tokens[cursor].value)) {
+        if (tokens[cursor]?.value === "import")
+          importClause = true;
+        cursor--;
+      }
+      const createsScope = !importClause && !DECLARATION_KEYWORDS.has(previous?.value ?? "") && !["=", "(", "[", ",", ":", "return"].includes(previous?.value ?? "");
+      braceCreatesScope.push(createsScope);
+      if (createsScope) {
+        const child = scopeParents.length;
+        scopeParents.push(stack.at(-1));
+        const previousValue = previous?.value;
+        let functionBody = previousValue === "=>";
+        if (previousValue === ")") {
+          const open2 = pairedToken(tokens, index - 1);
+          for (let cursor2 = open2 - 1;cursor2 >= 0; cursor2--) {
+            const value = tokens[cursor2]?.value;
+            if (value === "function") {
+              functionBody = true;
+              break;
+            }
+            if (value === ";" || value === "{" || value === "}")
+              break;
+          }
+        }
+        scopeIsFunction.push(functionBody);
+        stack.push(child);
+      }
+    } else if (tokens[index]?.value === "}") {
+      if (braceCreatesScope.pop() && stack.length > 1)
+        stack.pop();
+    }
+  }
+  return { scopeAtToken, scopeParents, scopeIsFunction };
+}
+function declarationScope(analysis, tokenIndex) {
+  if (analysis.varDeclarationIndexes.has(tokenIndex)) {
+    let scope = analysis.scopeAtToken[tokenIndex] ?? 0;
+    while (scope > 0 && !analysis.scopeIsFunction[scope]) {
+      scope = analysis.scopeParents[scope] ?? 0;
+    }
+    return scope;
+  }
+  const parameterScope = analysis.parameterScopes.get(tokenIndex);
+  if (parameterScope !== undefined)
+    return parameterScope;
+  return analysis.scopeAtToken[tokenIndex] ?? 0;
+}
+function visibleDeclarationScope(analysis, name, callIndex) {
+  const scopes = analysis.declarationScopes.get(name);
+  if (!scopes)
+    return null;
+  let scope = analysis.scopeAtToken[callIndex] ?? 0;
+  while (scope >= 0) {
+    if (scopes.has(scope))
+      return scope;
+    scope = analysis.scopeParents[scope] ?? -1;
+  }
+  return null;
+}
+function matchingToken(tokens, start, open2, close) {
+  if (tokens[start]?.value !== open2)
+    return -1;
+  const match = pairedToken(tokens, start);
+  return tokens[match]?.value === close ? match : -1;
+}
+function moduleAtCall(tokens, start, callee) {
+  if (tokens[start]?.value !== callee || tokens[start + 1]?.value !== "(" || tokens[start + 2]?.kind !== "string" || tokens[start + 3]?.value !== ")") {
+    return null;
+  }
+  return tokens[start + 2].value;
+}
+function declarationNames(tokens, start, end) {
+  const names = [];
+  if (tokens[start]?.value === "{") {
+    for (let index = start + 1;index < end; index++) {
+      const token = tokens[index];
+      if (token?.kind !== "identifier")
+        continue;
+      if (tokens[index + 1]?.value === ":") {
+        const local = tokens[index + 2];
+        if (local?.kind === "identifier")
+          names.push({ name: local.value, index: index + 2 });
+        index += 2;
+      } else if (tokens[index - 1]?.value !== ":") {
+        names.push({ name: token.value, index });
+      }
+    }
+  } else if (tokens[start]?.kind === "identifier") {
+    names.push({ name: tokens[start].value, index: start });
+  }
+  return names;
+}
+function nextFunctionOpen(tokens, start) {
+  for (let index = start + 1;index < tokens.length; index++) {
+    const value = tokens[index]?.value;
+    if (value === "(")
+      return index;
+    if (value === "{" || value === ";" || value === "=>")
+      return -1;
+  }
+  return -1;
+}
+function nextFunctionBody(tokens, start) {
+  for (let index = start;index < tokens.length; index++) {
+    const value = tokens[index]?.value;
+    if (value === "{")
+      return index;
+    if (value === ";" || value === "=>")
+      return -1;
+  }
+  return -1;
+}
+function collectDeclarations(analysis) {
+  const { tokens } = analysis;
+  const declarationTokenIndexes = new Set;
+  for (let index = 0;index < tokens.length; index++) {
+    const token = tokens[index];
+    if (!token)
+      continue;
+    if (token.value === "import") {
+      if (tokens[index + 1]?.value === "type")
+        continue;
+      if (tokens[index + 1]?.value === "{") {
+        const close = matchingToken(tokens, index + 1, "{", "}");
+        for (let cursor = index + 2;cursor > 0 && cursor < close; cursor++) {
+          const imported = tokens[cursor];
+          if (imported?.kind !== "identifier")
+            continue;
+          if (imported.value === "type") {
+            while (cursor < close && tokens[cursor]?.value !== ",")
+              cursor++;
+            continue;
+          }
+          const local = tokens[cursor + 1]?.value === "as" ? tokens[cursor + 2] : imported;
+          if (local?.kind === "identifier") {
+            addDeclaration(analysis, local.value);
+            declarationTokenIndexes.add(tokens[cursor + 1]?.value === "as" ? cursor + 2 : cursor);
+          }
+          while (cursor < close && tokens[cursor]?.value !== ",")
+            cursor++;
+        }
+      } else if (tokens[index + 1]?.value === "*" && tokens[index + 2]?.value === "as") {
+        const local = tokens[index + 3];
+        if (local?.kind === "identifier") {
+          addDeclaration(analysis, local.value);
+          declarationTokenIndexes.add(index + 3);
+        }
+      } else if (tokens[index + 1]?.kind === "identifier") {
+        addDeclaration(analysis, tokens[index + 1].value);
+        declarationTokenIndexes.add(index + 1);
+      }
+    }
+    if (DECLARATION_KEYWORDS.has(token.value)) {
+      const start = index + 1;
+      const close = tokens[start]?.value === "{" ? matchingToken(tokens, start, "{", "}") : start + 1;
+      for (const item of declarationNames(tokens, start, close)) {
+        addDeclaration(analysis, item.name);
+        declarationTokenIndexes.add(item.index);
+        if (token.value === "var")
+          analysis.varDeclarationIndexes.add(item.index);
+      }
+    }
+    if ((token.value === "function" || token.value === "class") && tokens[index + 1]?.kind === "identifier") {
+      addDeclaration(analysis, tokens[index + 1].value);
+      declarationTokenIndexes.add(index + 1);
+    }
+    if (token.value === "function") {
+      const open2 = nextFunctionOpen(tokens, index);
+      if (open2 > index) {
+        const close = matchingToken(tokens, open2, "(", ")");
+        const body = close >= 0 ? nextFunctionBody(tokens, close + 1) : -1;
+        const bodyScope = body >= 0 ? analysis.scopeAtToken[body + 1] ?? analysis.scopeAtToken[body] : undefined;
+        for (let cursor = open2 + 1;cursor < close; cursor++) {
+          if (tokens[cursor]?.kind === "identifier" && tokens[cursor - 1]?.value !== ".") {
+            addDeclaration(analysis, tokens[cursor].value);
+            declarationTokenIndexes.add(cursor);
+            if (bodyScope !== undefined)
+              analysis.parameterScopes.set(cursor, bodyScope);
+            while (cursor < close && tokens[cursor]?.value !== ",")
+              cursor++;
+          }
+        }
+      }
+    }
+    if (token.value === "catch" && tokens[index + 1]?.value === "(" && tokens[index + 2]?.kind === "identifier") {
+      addDeclaration(analysis, tokens[index + 2].value);
+      declarationTokenIndexes.add(index + 2);
+    }
+    if (token.kind === "identifier" && tokens[index + 1]?.value === "=>") {
+      addDeclaration(analysis, token.value);
+      declarationTokenIndexes.add(index);
+      const body = nextFunctionBody(tokens, index + 2);
+      if (body >= 0)
+        analysis.parameterScopes.set(index, analysis.scopeAtToken[body + 1] ?? analysis.scopeAtToken[body]);
+    }
+    if (token.value === "=>") {
+      let close = index - 1;
+      while (close >= 0 && tokens[close]?.value !== ")")
+        close--;
+      let cursor = close - 1;
+      let depth = 1;
+      while (cursor >= 0 && depth > 0) {
+        if (tokens[cursor]?.value === ")")
+          depth++;
+        else if (tokens[cursor]?.value === "(")
+          depth--;
+        cursor--;
+      }
+      const body = nextFunctionBody(tokens, index + 1);
+      const bodyScope = body >= 0 ? analysis.scopeAtToken[body + 1] ?? analysis.scopeAtToken[body] : undefined;
+      for (cursor += 2;cursor < close; cursor++) {
+        if (tokens[cursor]?.kind === "identifier") {
+          addDeclaration(analysis, tokens[cursor].value);
+          declarationTokenIndexes.add(cursor);
+          if (bodyScope !== undefined)
+            analysis.parameterScopes.set(cursor, bodyScope);
+          while (cursor < close && tokens[cursor]?.value !== ",")
+            cursor++;
+        }
+      }
+    }
+  }
+  return declarationTokenIndexes;
+}
+function collectFacts(analysis) {
+  const { tokens } = analysis;
+  for (let index = 0;index < tokens.length; index++) {
+    if (tokens[index]?.value === "import" && tokens[index + 1]?.value !== "type") {
+      if (tokens[index + 1]?.value === "{") {
+        const close = matchingToken(tokens, index + 1, "{", "}");
+        const module2 = tokens[close + 1]?.value === "from" ? tokens[close + 2]?.value : null;
+        for (let cursor = index + 2;cursor > 0 && cursor < close; cursor++) {
+          const imported = tokens[cursor];
+          if (imported?.kind !== "identifier")
+            continue;
+          if (imported.value === "type") {
+            while (cursor < close && tokens[cursor]?.value !== ",")
+              cursor++;
+            continue;
+          }
+          const local2 = tokens[cursor + 1]?.value === "as" ? tokens[cursor + 2] : imported;
+          if (local2?.kind === "identifier") {
+            if (CHILD_PROCESS_MODULES.has(module2 ?? "") && imported.value === "exec") {
+              addFact(analysis, local2.value, "child-direct", tokens[cursor + 1]?.value === "as" ? cursor + 2 : cursor);
+            } else if (module2)
+              addFact(analysis, local2.value, "other-import", tokens[cursor + 1]?.value === "as" ? cursor + 2 : cursor);
+          }
+          while (cursor < close && tokens[cursor]?.value !== ",")
+            cursor++;
+        }
+      } else if (tokens[index + 1]?.value === "*" && tokens[index + 2]?.value === "as") {
+        const local2 = tokens[index + 3];
+        const module2 = tokens[index + 4]?.value === "from" ? tokens[index + 5]?.value : null;
+        if (local2?.kind === "identifier" && module2) {
+          addFact(analysis, local2.value, CHILD_PROCESS_MODULES.has(module2) ? "child-namespace" : "other-import", index + 3);
+          analysis.requireDerived.add(local2.value);
+          addScopedMarker(analysis.requireDerivedScopes, local2.value, declarationScope(analysis, index + 3));
+        }
+      } else if (tokens[index + 1]?.kind === "identifier" && tokens[index + 2]?.value === "=" && tokens[index + 3]?.value === "require") {
+        const module2 = moduleAtCall(tokens, index + 3, "require");
+        if (module2)
+          addFact(analysis, tokens[index + 1].value, CHILD_PROCESS_MODULES.has(module2) ? "child-namespace" : "other-import", index + 1);
+      } else if (tokens[index + 1]?.kind === "identifier" && tokens[index + 2]?.value === "from" && tokens[index + 3]?.kind === "string") {
+        const local2 = tokens[index + 1];
+        addFact(analysis, local2.value, CHILD_PROCESS_MODULES.has(tokens[index + 3].value) ? "child-namespace" : "other-import", index + 1);
+      }
+    }
+    if (!DECLARATION_KEYWORDS.has(tokens[index]?.value ?? ""))
+      continue;
+    const start = index + 1;
+    if (tokens[start]?.value === "{") {
+      const close = matchingToken(tokens, start, "{", "}");
+      const rhs2 = close + 1;
+      const module2 = tokens[rhs2]?.value === "=" ? moduleAtCall(tokens, rhs2 + 1, "require") : null;
+      const namespace = tokens[rhs2]?.value === "=" && tokens[rhs2 + 1]?.kind === "identifier" ? tokens[rhs2 + 1].value : null;
+      for (let cursor = start + 1;cursor < close; cursor++) {
+        const imported = tokens[cursor];
+        if (imported?.kind !== "identifier")
+          continue;
+        const local2 = tokens[cursor + 1]?.value === ":" ? tokens[cursor + 2] : imported;
+        if (local2?.kind === "identifier" && imported.value === "exec") {
+          if (module2 && CHILD_PROCESS_MODULES.has(module2)) {
+            addFact(analysis, local2.value, "child-direct", tokens[cursor + 1]?.value === ":" ? cursor + 2 : cursor);
+            analysis.requireDerived.add(local2.value);
+            addScopedMarker(analysis.requireDerivedScopes, local2.value, declarationScope(analysis, tokens[cursor + 1]?.value === ":" ? cursor + 2 : cursor));
+          } else if (namespace && hasUniqueFact(analysis, namespace, rhs2 + 1, "child-namespace")) {
+            addFact(analysis, local2.value, "child-direct", tokens[cursor + 1]?.value === ":" ? cursor + 2 : cursor);
+            if (hasScopedMarker(analysis.requireDerivedScopes, namespace, visibleDeclarationScope(analysis, namespace, rhs2 + 1))) {
+              analysis.requireDerived.add(local2.value);
+              addScopedMarker(analysis.requireDerivedScopes, local2.value, declarationScope(analysis, tokens[cursor + 1]?.value === ":" ? cursor + 2 : cursor));
+            }
+          }
+        }
+        while (cursor < close && tokens[cursor]?.value !== ",")
+          cursor++;
+      }
+      continue;
+    }
+    const local = tokens[start];
+    if (local?.kind !== "identifier" || tokens[start + 1]?.value !== "=")
+      continue;
+    const rhs = start + 2;
+    const module = moduleAtCall(tokens, rhs, "require");
+    if (module) {
+      addFact(analysis, local.value, CHILD_PROCESS_MODULES.has(module) ? "child-namespace" : "other-import", start);
+      analysis.requireDerived.add(local.value);
+      addScopedMarker(analysis.requireDerivedScopes, local.value, declarationScope(analysis, start));
+    } else if (tokens[rhs]?.value === "import" || tokens[rhs]?.value === "await" && tokens[rhs + 1]?.value === "import") {
+      const importIndex = tokens[rhs]?.value === "await" ? rhs + 1 : rhs;
+      const importedModule = moduleAtCall(tokens, importIndex, "import");
+      if (importedModule) {
+        addFact(analysis, local.value, CHILD_PROCESS_MODULES.has(importedModule) ? "child-namespace" : "other-import", start);
+      }
+    } else if (tokens[rhs]?.kind === "regex" || tokens[rhs]?.value === "new" && tokens[rhs + 1]?.value === "RegExp") {
+      addFact(analysis, local.value, "regex", start);
+    } else if (tokens[rhs]?.kind === "identifier" && (tokens[rhs + 1]?.value === "." || tokens[rhs + 1]?.value === "?.") && tokens[rhs + 2]?.value === "exec" && hasUniqueFact(analysis, tokens[rhs].value, rhs, "child-namespace")) {
+      addFact(analysis, local.value, "child-direct", start);
+      if (hasScopedMarker(analysis.requireDerivedScopes, tokens[rhs].value, visibleDeclarationScope(analysis, tokens[rhs].value, rhs))) {
+        analysis.requireDerived.add(local.value);
+        addScopedMarker(analysis.requireDerivedScopes, local.value, declarationScope(analysis, start));
+      }
+    }
+  }
+}
+function hasUniqueFact(analysis, name, callIndex, fact) {
+  const scope = visibleDeclarationScope(analysis, name, callIndex);
+  const facts = scope === null ? undefined : analysis.factScopes.get(name)?.get(scope);
+  return scope !== null && analysis.declarationScopes.get(name)?.get(scope) === 1 && !hasScopedMarker(analysis.reassignedScopes, name, scope) && facts?.size === 1 && facts.has(fact);
+}
+function buildAnalysis(context) {
+  const lineStarts = [0];
+  for (let index = 0;index < context.content.length; index++) {
+    if (context.content[index] === `
+`)
+      lineStarts.push(index + 1);
+  }
+  if (context.content.length > MAX_ANALYSIS_BYTES) {
+    return {
+      tokens: [],
+      lineStarts,
+      scopeAtToken: [],
+      scopeParents: [-1],
+      scopeIsFunction: [true],
+      declarations: new Map,
+      declarationScopes: new Map,
+      facts: new Map,
+      factScopes: new Map,
+      reassigned: new Set,
+      reassignedScopes: new Map,
+      mutatedMembers: new Set,
+      mutatedMemberScopes: new Map,
+      requireDerived: new Set,
+      requireDerivedScopes: new Map,
+      parameterScopes: new Map,
+      varDeclarationIndexes: new Set,
+      oversizedOrMalformed: true
+    };
+  }
+  const tokenized = tokenize2(context.content);
+  const scopes = buildScopes(tokenized.tokens);
+  const analysis = {
+    tokens: tokenized.tokens,
+    lineStarts,
+    scopeAtToken: scopes.scopeAtToken,
+    scopeParents: scopes.scopeParents,
+    scopeIsFunction: scopes.scopeIsFunction,
+    declarations: new Map,
+    declarationScopes: new Map,
+    facts: new Map,
+    factScopes: new Map,
+    reassigned: new Set,
+    reassignedScopes: new Map,
+    mutatedMembers: new Set,
+    mutatedMemberScopes: new Map,
+    requireDerived: new Set,
+    requireDerivedScopes: new Map,
+    parameterScopes: new Map,
+    varDeclarationIndexes: new Set,
+    oversizedOrMalformed: tokenized.malformed
+  };
+  const declarationIndexes = collectDeclarations(analysis);
+  for (const index of declarationIndexes) {
+    const name = analysis.tokens[index]?.value;
+    if (!name)
+      continue;
+    const scope = declarationScope(analysis, index);
+    const counts = analysis.declarationScopes.get(name) ?? new Map;
+    counts.set(scope, (counts.get(scope) ?? 0) + 1);
+    analysis.declarationScopes.set(name, counts);
+  }
+  collectFacts(analysis);
+  for (let index = 0;index < analysis.tokens.length; index++) {
+    const token = analysis.tokens[index];
+    if (token?.kind !== "identifier" || declarationIndexes.has(index))
+      continue;
+    const previous = analysis.tokens[index - 1]?.value;
+    if (previous === "." || previous === "?.") {
+      if (token.value === "exec" && (ASSIGNMENTS.has(analysis.tokens[index + 1]?.value ?? "") || analysis.tokens[index - 3]?.value === "delete")) {
+        const receiver = analysis.tokens[index - 2];
+        if (receiver?.kind === "identifier") {
+          analysis.mutatedMembers.add(receiver.value);
+          addScopedMarker(analysis.mutatedMemberScopes, receiver.value, visibleDeclarationScope(analysis, receiver.value, index - 2) ?? analysis.scopeAtToken[index - 2] ?? 0);
+        }
+      }
+      continue;
+    }
+    if (ASSIGNMENTS.has(analysis.tokens[index + 1]?.value ?? "") || previous === "++" || previous === "--" || analysis.tokens[index + 1]?.value === "++" || analysis.tokens[index + 1]?.value === "--") {
+      analysis.reassigned.add(token.value);
+      addScopedMarker(analysis.reassignedScopes, token.value, visibleDeclarationScope(analysis, token.value, index) ?? analysis.scopeAtToken[index] ?? 0);
+    }
+  }
+  return analysis;
+}
+function getAnalysis(context) {
+  let analysis = analysisByContext.get(context);
+  if (!analysis) {
+    analysis = buildAnalysis(context);
+    analysisByContext.set(context, analysis);
+  }
+  return analysis;
+}
+function tokenIndexAtOffset(tokens, offset) {
+  let low = 0;
+  let high = tokens.length - 1;
+  while (low <= high) {
+    const mid = low + high >>> 1;
+    const token = tokens[mid];
+    if (offset < token.start)
+      high = mid - 1;
+    else if (offset >= token.end)
+      low = mid + 1;
+    else
+      return mid;
+  }
+  return -1;
+}
+function directRequireBefore(tokens, dotIndex) {
+  if (tokens[dotIndex - 1]?.value !== ")")
+    return false;
+  for (let start = dotIndex - 2;start >= 0 && start >= dotIndex - 5; start--) {
+    const module = moduleAtCall(tokens, start, "require");
+    if (module && start + 4 === dotIndex)
+      return CHILD_PROCESS_MODULES.has(module);
+  }
+  return false;
+}
+function isTransparentWrapperCall(tokens, openIndex) {
+  return tokens[openIndex - 1]?.kind === "identifier" ? tokens[openIndex - 1].value === "promisify" : false;
+}
+function shouldSkipTrailingClose(tokens, nameIndex, closeIndex) {
+  const openIndex = pairedToken(tokens, closeIndex);
+  if (openIndex < 0 || openIndex > nameIndex)
+    return false;
+  const beforeOpen = tokens[openIndex - 1];
+  if (!beforeOpen || beforeOpen.kind !== "identifier" && beforeOpen.kind !== "string" && beforeOpen.kind !== "regex" && beforeOpen.value !== ")" && beforeOpen.value !== "]") {
+    return true;
+  }
+  return isTransparentWrapperCall(tokens, openIndex);
+}
+function parseCallee(tokens, nameIndex) {
+  const nameToken = tokens[nameIndex];
+  if (!nameToken)
+    return null;
+  let cursor = nameIndex + 1;
+  if (nameToken.kind === "string") {
+    if (tokens[nameIndex - 1]?.value !== "[" || tokens[nameIndex + 1]?.value !== "]")
+      return null;
+    cursor = nameIndex + 2;
+  }
+  while (tokens[cursor]?.value === ")" && shouldSkipTrailingClose(tokens, nameIndex, cursor)) {
+    cursor++;
+  }
+  if (tokens[cursor]?.value === "?.")
+    cursor++;
+  if (tokens[cursor]?.value !== "(")
+    return null;
+  const callee = { name: nameToken.value, openParen: cursor };
+  const accessIndex = nameToken.kind === "string" ? nameIndex - 1 : nameIndex - 1;
+  if (nameToken.kind === "string") {
+    const receiver = tokens[nameIndex - 2];
+    if (receiver?.kind === "identifier") {
+      callee.receiver = receiver.value;
+      callee.receiverKind = "identifier";
+    } else if (receiver?.kind === "regex")
+      callee.receiverKind = "regex";
+    return callee;
+  }
+  if (tokens[accessIndex]?.value === "." || tokens[accessIndex]?.value === "?.") {
+    const receiver = tokens[accessIndex - 1];
+    if (receiver?.kind === "identifier") {
+      callee.receiver = receiver.value;
+      callee.receiverKind = "identifier";
+    } else if (receiver?.kind === "regex")
+      callee.receiverKind = "regex";
+    else if (directRequireBefore(tokens, accessIndex))
+      callee.receiverKind = "direct-child-require";
+  }
+  return callee;
+}
+function bindingDisposition(analysis, name, confirmedFact, callIndex) {
+  const visibleScope = visibleDeclarationScope(analysis, name, callIndex);
+  if (visibleScope === null)
+    return "ambiguous";
+  const declarationCount = analysis.declarationScopes.get(name)?.get(visibleScope) ?? 0;
+  const facts = analysis.factScopes.get(name)?.get(visibleScope);
+  if (hasScopedMarker(analysis.requireDerivedScopes, name, visibleScope) && globalDisposition(analysis, "require", callIndex) !== "confirmed") {
+    return "ambiguous";
+  }
+  if (declarationCount !== 1 || hasScopedMarker(analysis.reassignedScopes, name, visibleScope) || !facts || facts.size !== 1) {
+    return "ambiguous";
+  }
+  if (facts.has(confirmedFact))
+    return "confirmed";
+  if (facts.has("other-import") || facts.has("regex"))
+    return "safe";
+  return "ambiguous";
+}
+function globalDisposition(analysis, name, callIndex) {
+  const visibleScope = visibleDeclarationScope(analysis, name, callIndex);
+  if (visibleScope === null && !hasVisibleMarker(analysis, analysis.reassignedScopes, name, callIndex)) {
+    return "confirmed";
+  }
+  const facts = visibleScope === null ? undefined : analysis.factScopes.get(name)?.get(visibleScope);
+  if (facts?.size === 1 && facts.has("other-import") && visibleScope !== null && analysis.declarationScopes.get(name)?.get(visibleScope) === 1 && !hasScopedMarker(analysis.reassignedScopes, name, visibleScope)) {
+    return "safe";
+  }
+  return "ambiguous";
+}
+function firstArgument(tokens, openParen) {
+  return tokens[openParen + 1];
+}
+function oversizedCandidate(match, family) {
+  const expected = family === "exec" ? ["exec"] : family === "eval" ? ["eval"] : family === "function-constructor" ? ["Function"] : family === "timer-string" ? ["setTimeout", "setInterval"] : family === "document-write" ? ["write"] : ["addEventListener"];
+  return expected.includes(match.text) ? "ambiguous" : "none";
+}
+function classifyJavascriptCallUncached(match, context, family) {
+  const analysis = getAnalysis(context);
+  if (analysis.oversizedOrMalformed)
+    return oversizedCandidate(match, family);
+  const offset = (analysis.lineStarts[match.line - 1] ?? 0) + match.column - 1;
+  const tokenIndex = tokenIndexAtOffset(analysis.tokens, offset);
+  if (tokenIndex < 0)
+    return "none";
+  const callee = parseCallee(analysis.tokens, tokenIndex);
+  if (!callee)
+    return "none";
+  const argument = firstArgument(analysis.tokens, callee.openParen);
+  switch (family) {
+    case "exec":
+      if (!argument || argument.value === ")")
+        return "none";
+      if (callee.receiverKind === "regex")
+        return "safe";
+      if (callee.receiverKind === "direct-child-require") {
+        if (callee.name !== "exec")
+          return "none";
+        return globalDisposition(analysis, "require", tokenIndex) === "confirmed" ? "confirmed" : "ambiguous";
+      }
+      if (callee.receiver) {
+        if (callee.name !== "exec")
+          return "none";
+        if (hasScopedMarker(analysis.mutatedMemberScopes, callee.receiver, visibleDeclarationScope(analysis, callee.receiver, tokenIndex))) {
+          return "ambiguous";
+        }
+        return bindingDisposition(analysis, callee.receiver, "child-namespace", tokenIndex);
+      }
+      if (callee.name === "exec" || factsAtVisibleScope(analysis, callee.name, tokenIndex)?.has("child-direct")) {
+        return bindingDisposition(analysis, callee.name, "child-direct", tokenIndex);
+      }
+      return "none";
+    case "eval":
+      if (callee.name !== "eval")
+        return "none";
+      if (callee.receiver) {
+        if (["globalThis", "window", "self"].includes(callee.receiver)) {
+          return globalDisposition(analysis, callee.receiver, tokenIndex);
+        }
+        return bindingDisposition(analysis, callee.receiver, "child-namespace", tokenIndex) === "safe" ? "safe" : "ambiguous";
+      }
+      return globalDisposition(analysis, "eval", tokenIndex);
+    case "function-constructor":
+      if (callee.name !== "Function" || analysis.tokens[tokenIndex - 1]?.value !== "new")
+        return "none";
+      return globalDisposition(analysis, "Function", tokenIndex);
+    case "timer-string":
+      if (!["setTimeout", "setInterval"].includes(callee.name) || !argument || !["string", "template"].includes(argument.kind))
+        return "none";
+      if (callee.receiver) {
+        if (["globalThis", "window", "self"].includes(callee.receiver))
+          return globalDisposition(analysis, callee.receiver, tokenIndex);
+        return bindingDisposition(analysis, callee.receiver, "child-namespace", tokenIndex) === "safe" ? "safe" : "ambiguous";
+      }
+      return globalDisposition(analysis, callee.name, tokenIndex);
+    case "document-write":
+      if (callee.name !== "write" || callee.receiver !== "document")
+        return "none";
+      return globalDisposition(analysis, "document", tokenIndex) === "confirmed" ? "confirmed" : "ambiguous";
+    case "postmessage":
+      if (callee.name !== "addEventListener" || argument?.kind !== "string" || argument.value !== "message")
+        return "none";
+      if (callee.receiver) {
+        if (["globalThis", "window", "self"].includes(callee.receiver))
+          return globalDisposition(analysis, callee.receiver, tokenIndex);
+        return bindingDisposition(analysis, callee.receiver, "child-namespace", tokenIndex) === "safe" ? "safe" : "ambiguous";
+      }
+      return globalDisposition(analysis, "addEventListener", tokenIndex);
+  }
+}
+function classifyJavascriptCall(match, context, family) {
+  const key = `${family}:${match.line}:${match.column}:${match.text}`;
+  const cache2 = dispositionByContext.get(context) ?? new Map;
+  const cached = cache2.get(key);
+  if (cached !== undefined)
+    return cached;
+  const disposition = classifyJavascriptCallUncached(match, context, family);
+  cache2.set(key, disposition);
+  dispositionByContext.set(context, cache2);
+  return disposition;
+}
+
 // src/sast/rules/javascript.ts
+function hasDisposition(family, disposition) {
+  return (match, context) => classifyJavascriptCall(match, context, family) === disposition;
+}
 var javascriptRules = [
   {
     id: "sast/js-eval",
@@ -41971,7 +42938,18 @@ var javascriptRules = [
     languages: ["javascript", "typescript"],
     description: "Dangerous use of eval() detected - allows arbitrary code execution",
     remediation: "Avoid using eval(). If you must parse dynamic content, use JSON.parse() or a proper parser instead.",
-    pattern: /\beval\s*\(/
+    pattern: /\beval\b/,
+    validate: hasDisposition("eval", "confirmed")
+  },
+  {
+    id: "sast/js-eval-review",
+    name: "Unresolved eval-like call",
+    severity: "low",
+    languages: ["javascript", "typescript"],
+    description: "Unresolved eval-like call requires manual review",
+    remediation: "Verify the callee binding and avoid dynamic code evaluation.",
+    pattern: /\beval\b/,
+    validate: hasDisposition("eval", "ambiguous")
   },
   {
     id: "sast/js-dangerous-function",
@@ -41980,7 +42958,18 @@ var javascriptRules = [
     languages: ["javascript", "typescript"],
     description: "Dangerous use of new Function() detected - allows arbitrary code execution",
     remediation: "Avoid using new Function(). Use a safer alternative like JSON.parse() or a proper expression parser.",
-    pattern: /\bnew\s+Function\s*\(/
+    pattern: /\bFunction\b/,
+    validate: hasDisposition("function-constructor", "confirmed")
+  },
+  {
+    id: "sast/js-function-constructor-review",
+    name: "Unresolved Function-like constructor",
+    severity: "low",
+    languages: ["javascript", "typescript"],
+    description: "Unresolved Function-like constructor requires manual review",
+    remediation: "Verify the constructor binding and avoid dynamic code construction.",
+    pattern: /\bFunction\b/,
+    validate: hasDisposition("function-constructor", "ambiguous")
   },
   {
     id: "sast/js-command-injection",
@@ -41989,10 +42978,18 @@ var javascriptRules = [
     languages: ["javascript", "typescript"],
     description: "Potential command injection via child_process.exec() with unsanitized input",
     remediation: "Never pass user input directly to exec(). Use execFile() with arguments array or sanitize input thoroughly.",
-    pattern: /exec\s*\(\s*(?:[`'"]|\w)/,
-    validate: (_match, _context) => {
-      return true;
-    }
+    pattern: /[A-Za-z_$][\w$]*/,
+    validate: hasDisposition("exec", "confirmed")
+  },
+  {
+    id: "sast/js-command-exec-review",
+    name: "Unresolved exec-like call",
+    severity: "low",
+    languages: ["javascript", "typescript"],
+    description: "Unresolved exec-like call requires manual review",
+    remediation: "Verify whether the callee reaches child_process; prefer execFile() with an arguments array.",
+    pattern: /[A-Za-z_$][\w$]*/,
+    validate: hasDisposition("exec", "ambiguous")
   },
   {
     id: "sast/js-set-timeout-string",
@@ -42001,7 +42998,18 @@ var javascriptRules = [
     languages: ["javascript", "typescript"],
     description: "setTimeout/setInterval called with string argument - similar to eval()",
     remediation: 'Use function references instead of strings: setTimeout(() => ..., 1000) instead of setTimeout("...", 1000)',
-    pattern: /(?:setTimeout|setInterval)\s*\(\s*['"`]/
+    pattern: /\b(?:setTimeout|setInterval)\b/,
+    validate: hasDisposition("timer-string", "confirmed")
+  },
+  {
+    id: "sast/js-timer-string-review",
+    name: "Unresolved string timer call",
+    severity: "low",
+    languages: ["javascript", "typescript"],
+    description: "Unresolved string timer call requires manual review",
+    remediation: "Verify the timer binding and replace string callbacks with functions.",
+    pattern: /\b(?:setTimeout|setInterval)\b/,
+    validate: hasDisposition("timer-string", "ambiguous")
   },
   {
     id: "sast/js-innerhtml",
@@ -42019,7 +43027,18 @@ var javascriptRules = [
     languages: ["javascript", "typescript"],
     description: "document.write() can introduce XSS vulnerabilities",
     remediation: "Use DOM manipulation methods (createElement, appendChild, textContent) instead.",
-    pattern: /document\.write\s*\(/
+    pattern: /\bwrite\b/,
+    validate: hasDisposition("document-write", "confirmed")
+  },
+  {
+    id: "sast/js-document-write-review",
+    name: "Unresolved document.write-like call",
+    severity: "low",
+    languages: ["javascript", "typescript"],
+    description: "Unresolved document.write-like call requires manual review",
+    remediation: "Verify the document binding and use safe DOM construction.",
+    pattern: /\bwrite\b/,
+    validate: hasDisposition("document-write", "ambiguous")
   },
   {
     id: "sast/js-postmessage",
@@ -42028,7 +43047,18 @@ var javascriptRules = [
     languages: ["javascript", "typescript"],
     description: "postMessage event listener without origin validation",
     remediation: "Always validate the origin in postMessage event handlers: event.origin === expectedOrigin",
-    pattern: /addEventListener\s*\(\s*['"]message['"]/
+    pattern: /\baddEventListener\b/,
+    validate: hasDisposition("postmessage", "confirmed")
+  },
+  {
+    id: "sast/js-postmessage-review",
+    name: "Unresolved message-listener call",
+    severity: "low",
+    languages: ["javascript", "typescript"],
+    description: "Unresolved message-listener call requires manual review",
+    remediation: "Verify the event target and validate message origins where applicable.",
+    pattern: /\baddEventListener\b/,
+    validate: hasDisposition("postmessage", "ambiguous")
   },
   {
     id: "sast/js-hardcoded-secret",
@@ -42338,23 +43368,23 @@ function executeRulesSync(filePath, content, language) {
   const findings = [];
   const normalizedLang = language.toLowerCase();
   const rules = getRulesForLanguage(normalizedLang);
+  const lines = content.split(`
+`);
+  const context = {
+    filePath,
+    content,
+    language: normalizedLang
+  };
   for (const rule of rules) {
     if (!rule.pattern)
       continue;
     const matches = findPatternMatches(content, rule.pattern);
     for (const match of matches) {
       if (rule.validate) {
-        const context = {
-          filePath,
-          content,
-          language: normalizedLang
-        };
         if (!rule.validate(match, context)) {
           continue;
         }
       }
-      const lines = content.split(`
-`);
       const excerpt = lines[match.line - 1]?.trim() || "";
       findings.push({
         rule_id: rule.id,
@@ -70409,7 +71439,7 @@ function buildDetailedHelp(commandName, entry) {
 async function handleHelpCommand(ctx) {
   const targetCommand = ctx.args.join(" ");
   if (!targetCommand) {
-    const { buildHelpText } = await import("./index-rzzwem6x.js");
+    const { buildHelpText } = await import("./index-ag9bv589.js");
     return buildHelpText();
   }
   const tokens = targetCommand.split(/\s+/);
@@ -70418,7 +71448,7 @@ async function handleHelpCommand(ctx) {
     return _internals98.buildDetailedHelp(resolved.key, resolved.entry);
   }
   const similar = _internals98.findSimilarCommands(targetCommand);
-  const { buildHelpText: fullHelp } = await import("./index-rzzwem6x.js");
+  const { buildHelpText: fullHelp } = await import("./index-ag9bv589.js");
   if (similar.length > 0) {
     return `Command '/swarm ${targetCommand}' not found.
 
@@ -70598,7 +71628,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail explain": {
     handler: async (ctx) => {
-      const { handleGuardrailExplain } = await import("./guardrail-explain-2n3ahs0m.js");
+      const { handleGuardrailExplain } = await import("./guardrail-explain-a8706sq1.js");
       return handleGuardrailExplain(ctx.directory, ctx.args);
     },
     description: "Dry-run: show what the guardrails would do to a command or write target (executes nothing)",
@@ -70608,7 +71638,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail reset": {
     handler: async (ctx) => {
-      const { handleGuardrailReset } = await import("./guardrail-reset-be3sx0am.js");
+      const { handleGuardrailReset } = await import("./guardrail-reset-sy0vztrd.js");
       return handleGuardrailReset(ctx.args, ctx.sessionID);
     },
     description: "Reset one exact active invocation/action circuit after repair",
@@ -70617,7 +71647,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail-explain": {
     handler: async (ctx) => {
-      const { handleGuardrailExplain } = await import("./guardrail-explain-2n3ahs0m.js");
+      const { handleGuardrailExplain } = await import("./guardrail-explain-a8706sq1.js");
       return handleGuardrailExplain(ctx.directory, ctx.args);
     },
     description: "Dry-run: show what the guardrails would do to a command or write target (executes nothing)",
@@ -70627,7 +71657,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail-reset": {
     handler: async (ctx) => {
-      const { handleGuardrailReset } = await import("./guardrail-reset-be3sx0am.js");
+      const { handleGuardrailReset } = await import("./guardrail-reset-sy0vztrd.js");
       return handleGuardrailReset(ctx.args, ctx.sessionID);
     },
     description: "Reset one exact active invocation/action circuit after repair",
@@ -70637,7 +71667,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail-log": {
     handler: async (ctx) => {
-      const { handleGuardrailLog } = await import("./guardrail-log-bmxrb3r2.js");
+      const { handleGuardrailLog } = await import("./guardrail-log-wx43bj32.js");
       return handleGuardrailLog(ctx.directory, ctx.args);
     },
     description: "Read the guardrail decision log (use --blocks-only for blocks)",
@@ -77628,7 +78658,7 @@ async function precreateStandardWorktreeSession(args) {
   const laneProfile = computeLaneRuntimeProfile(worktreeConfig.runtime_isolation, laneIndex, provisionResult.worktreePath);
   if (laneProfile) {
     try {
-      const { writeLaneProfileToDiskReal } = await import("./core-a1bhs3xa.js");
+      const { writeLaneProfileToDiskReal } = await import("./core-0ph6pb2y.js");
       await writeLaneProfileToDiskReal(provisionResult.worktreePath, laneProfile.laneIndex, laneProfile.envOverrides);
     } catch {}
   }
@@ -78286,7 +79316,7 @@ async function finishStandardWorktreeDispatch(directory, dispatch, config, callI
       }
       clearWorktreeMergeStatus(statusKey);
       try {
-        const { removeLaneProfileFromDiskReal } = await import("./core-a1bhs3xa.js");
+        const { removeLaneProfileFromDiskReal } = await import("./core-0ph6pb2y.js");
         await removeLaneProfileFromDiskReal(dispatch.handle.worktreePath, dispatch.laneIndex);
       } catch {}
       const state = serializationStateBySessionID.get(dispatch.parentSessionID);